Apache Kylin CVE-2026-108833

Exploitation requires that the Kylin instance was launched using the DEFAULT startup profile with the security settings profile NOT enabled - the advisory explicitly states that any deployment with the security setting profile turned on is not impacted. The attacker must also be able to reach the instance over the network. The principal limiting factors are therefore operator configuration (an administrator who enabled the security profile is immune) and network exposure (instances deployed on isolated internal networks are far less reachable); the precise authentication level and data accessible cannot be confirmed from public data because full details are withheld in the ASF security process.

This is a low-severity configuration-hardening flaw rather than a memory-corruption or injection bug: Apache Kylin's default startup profile ships without the security (authentication) settings enabled, so a deployment launched with that default profile may be reachable without the intended access controls. No CVSS vector was published by the vendor or NVD (both report N/A), there is no EPSS score, the CVE is not in CISA KEV, and no public proof-of-concept exists - so every exploitation signal that would elevate priority is either absent or negative. The only elevating factor is that the INSECURE state is the DEFAULT, meaning operators who never explicitly enabled the security profile are exposed, which is the opposite of a non-default edge case. There is a notable tension to flag: the vendor rates this 'low', yet a missing-authentication-by-default condition on a data-warehouse engine could in principle allow unauthenticated data access, which would normally score higher - the low rating most plausibly reflects that the full technical impact is being withheld in the ASF private security process and/or that production Kylin instances are typically deployed on internal networks behind other controls. Because the technical details are not public, treat the precise impact as unconfirmed and verify against the private advisory or KYLIN-6113 remediation notes.

An attacker with network reachability to an Apache Kylin instance (4.0.0-5.0.4) that was started with the default startup profile - i.e., where the separate security settings profile was never enabled - connects to the exposed interface and interacts with it without the intended authentication being enforced, potentially reading analytical data or invoking functions. No public exploit code exists, and deployments that enabled the security profile are not affected.